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Abstract. If y is a commutative algebraic group over a field fc, O is a com- 
mutative ring that acts on V, and I is a finitely generated free O-module with 
a right action of the absolute Galois group of k, then there is a commutative 
algebraic group I^o V over k, which is a twist of a power of V. These group 
varieties have applications to cryptography (in the cases of abelian varieties 
and algebraic tori over finite fields) and to the arithmetic of abelian varieties 
over number fields. For purposes of such applications we devote this article to 
making explicit this tensor product construction and its basic properties. 



Introduction 

In this paper we study twists of powers of commutative algebraic groups. We 
have been using and proving special cases of these results elsewhere, and believe 
that it would be useful to have a complete theory and complete proofs in the 
literature in one place. Examples of applications of these twists that already appear 
in the literature include: to polarizations on abelian varieties to cryptography 
( [El IRSl] in the case of abelian varieties over finite fields and [RS2| in the case of 
algebraic tori over finite fields), to constructing abelian varieties over number fields 
with Shafarevich-Tate groups of nonsquare order [Stj , and to bounding below the 
Selmer rank of abelian varieties over dihedral extensions of number fields [MR] . 

Suppose V is a commutative algebraic group over a field fc, O is a commutative 
ring that acts on V, and X is a finitely generated free O-module with a right action 
of the absolute Galois group Gk of k. We will define a commutative algebraic group 
over k that we will denote X (E)o which is a twist of a power of V. 

The general theory underlying the construction of Z^o^ is given in the standard 
sources discussing the homological algebra of tensor products of sheaves for the etale 
topology (see jGVj . particularly Proposition 12.7 on p. 205). In that language, 
T 'E)o 1^ is a tensor product in the category of sheaves on the big etale site over 
Spec(fc). This tensor product construction was introduced by Serre (§2 of jSelj ) 
in the case where V is an elliptic curve with complex multiplication by O and I 
is a projective O-module with trivial Galois action. It is discussed in detail by 
Conrad (§7 of [C]) in the case where is a group scheme with O-action and 2 is 
a projective O-module with trivial Galois action. Our main objective is to record, 
in some detail and in a usable way, the basic features regarding the operation of 
tensoring an abelian group scheme over k endowed with a ring O of operators 
(viewing the group scheme as a sheaf for the big etale topology over Spec(fc)) with 
a locally constant sheaf over Spec(fc) of free O- modules of finite rank, noting that 
the new sheaf given by this tensor product construction is again representable as a 
group scheme over k with an O-action. To effectively make use of this construction 
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in our applications, we found that we must pin things down very explicitly. For 
ease of reading we provide in this article a largely self-contained treatment. 

In [JT] and ^ following Milne [Mij who dealt with the case of abelian varieties, 
we give a concrete definition of X (E)o f^nd we prove some important properties. 
Some basic examples are given in Examples 11.51 Our construction is functorial in 
both T and V (Theorem ll.8|) . and if Z decomposes (up to finite index) as ®iJ'i, then 
T (E)o y is isogenous to ®i{J^i ® V) (see Corollarv l2.5p . Theorem 12.21 describes the 
action of Gk on the torsion points of X (E)a V. We include a more general explicit 
construction of X without the assumption that Z is a free O-module, in an 

appendix. 

If i is a finite Galois extension of k and G := Gal(i/fc), then Z[G] ®z V is 
the restriction of scalars Res^V^. Theorem 14.51 shows that Res^V^ is isogenous to 
®p{Xp ®z y), where p runs through the irreducible rational representations of G 
and Xp is the intersection of 1\G\ with the p-isotypic component of Q[G']. In ij5]we 
restrict to the case where L/k is abelian, which is the case of interest in many of the 
applications. Similar results were obtained by Diem and Naumann [DNJ in the case 
of abelian varieties. In fJHlwe study cases where Gal(L/fc) is a semi-direct product, 
which are needed for the applications in [MRj . We study finite group actions on 
X ®o F in [jTl these results have cryptographic significance in the case of algebraic 
tori. 

We thank Dick Gross for drawing our attention to Conrad's paper [C]. 

Notation. Let Z+ denote the set of positive integers. If fc is a field, k^ will denote 
a separable closure of k and Gk := Gal{k^ /k). In this paper "ring" will always 
mean ring with identity, and "commutative algebraic group" will always mean a 
commutative algebraic group variety (not necessarily connected). 

If n G Z+, let //„ denote the group of n-th roots of unity in Q. If G is a finite 
group, then Z[G] will denote the group ring, except that denotes the ring of 

integers of the cyclotomic field Q(/x„). 

Suppose fc is a field and O is a commutative ring. We consider two categories: 

• FModc)(fc) is the category whose objects are finitely generated free O- 
modules with a continuous right action of Gk, and whose morphisms are 
Gfc-equivariant O-module homomorphisms (the modules are given the dis- 
crete topology, so a continuous Gfc-action is one that factors through a 
finite extension of k). 

• CAGo{k) is the category whose objects are commutative algebraic groups 
V over k with an action of O, i.e., a ring homomorphism O — *■ Endfe(y), 
and whose morphisms are O-equi variant homomorphisms defined over fc. 

li X,J G FModc)(fc) we will view Homc)(I, JT) as a left G^-module, where 
for / e Homc)(T, J"), 7 e G^, and x e X, we define {f^){x) = f{x^)^~^. View 
O e FModci(fc) with trivial Gfc-action. 

1. Twisting commutative algebraic groups 

Fix a field fc and a commutative ring O. In this section we construct a functor 
FModo(fc) X CAGo(fc) CAGo(fc), which we wiU denote by (Z, y) i-> J^o V. 
This construction appears in §2 of [Mi| when V is an abelian variety. 

Definition 1.1. Suppose V G CAGo(fc) and X e FModc)(fc). Define the X -twist 
X (gio V of V as follows. Let d — ranko {X) , and fix an O-module isomorphism 



TWISTING COMMUTATIVE ALGEBRAIC GROUPS 



3 



j : O'^ ^I. The homomorphism O Endfe(V") induces 

and we let cj G H^{k, Autk={V'^)) be the image of the cocycle (7 n- j^^ ° P) under 
this composition. Define I ®o V to be the twist of by the cocycle cj. Namely, 
by Corollaire to Proposition 5 on p. 131 in §111-1.3 of [Se3j (see also §3.1 of [V]). 
there is a pair {2 V, cj)) (unique up to isomorphism) where I V S CAGo{k) 
and (f> : ^ I®o V is an isomorphism defined over k^ such that for every 7 S G^, 

ci(7) = r'° (1.1) 

Remark 1.2. Suppose L is a separable extension of k and Gl acts trivially on 
I. Then p = j for all 7 e Gl, so 01(7) 1, so = by Thus the 

isomorphism cj) : ^ T (E)o V is defined over L. 

If we choose a different O-module isomorphism j' : O'^ ^ I in Definition II. 1[ 
then j' — j o a for some a G GLd{0). The cocycles 7 1— > j~^^p and 7 
(j')^^(j')'' = Q^^^i^^i'^^Q^^ represent the same class in H^{k,GL^{0)), so they 
give rise to the same class cx G i?^(fc, Auti.a(y^)). Thus I ^ is independent of 
the choice of j . 

If L/k is a Galois extension, y is a commutative algebraic group over fc, I G 
F'M.oda{k), and A is a commutative fc-algebra, let j ^ Gk act on A L as 1 (g) 7 
and on X (g)o {V{A (^k L)) as 7"^ (8) (1 7). 

Lemma 1.3. Suppose I E FModc)(fc), y G CAGc>{k), and L is a Galois ex- 
tension of k such that Gl acts trivially on X. Fix an O-module isomorphism 
j : O'^ ^ X, and let (p : V^^ ^X ®o V be as in Definition Then for every 
commutative k-algebra A, the composition 

(J ®o V){A ®uL)^X ®o {V{A ®k L)) 

of the sequence of O-module isomorphisms 

{X®oV){A®kL) ^ V'^(A(g)kL)^0''(E)o{V{A(g)kL)) ^ Z®o(y(A®feL)) 

is a Gk-equivariant O-module isomorphism that is independent of j and is functorial 
in A, V , X, and L. 

Proof. Remark 11.21 shows that (j) is defined over L, and therefore 0(y^(A ®kL)) = 
{X ®o V){A ®k L). The Gfc-equi variance of the composition and the independence 
of j follow from p.ip and the definition of cj. The functoriality is clear. □ 

Theorem 1.4. Suppose X G FModc)(fc) and V G CAGci(fc). Let L be a Galois 
extension of k such that Gl acts trivially on X. Then X ®c) V represents the 
functor on commutative k-algebras A 1— > (T®c) (y(A(g)feL)))^^''^"''/*''' . More precisely, 
for every commutative k-algebra A, the isomorphism of Lemma \L3\ restricts to a 
functorial group isomorphism 

{X(g>o V)iA) - {X®o {V{A®k L)))G"i(^/'=). 

Proof. This follows directly from Lemma [1.31 since [A ®k L)'^^ = A and Gl acts 
trivially on X and L. □ 

Examples 1.5. (i) Suppose < d G Z, and X = O^ with trivial Galois 

action. Then X-gjoV ^ V^. 
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(ii) Suppose x is a quadratic character of Gfc, and X is a free, rank-one Z- 
module with Gk acting via x. Then X ®z V is the quadratic twist of V by 
X- More generaUy, if O = Z[/x„], x '■ Gk M„ is a homomorphism, and 
T is a free, rank-one O-module with Gk acting via x, then 2 ®o V is the 
twist of V hy x^^ (in this case the cocycle cx is X^^)- 

(iii) Suppose V = Gm, the muhiphcative group, and Z is a free Z-module. Then 
I®z V is the algebraic torus whose character module Hom(I(g)z V, Gm) is 
Honi(J,Z). See Corollary OU] below, and Example 6 in §3.4 of [Vj. 

(iv) If i/fc is a finite Galois extension then 0[Gal{L/k)] ®o V = Res^F (see 
Proposition 14.11 below) . 

Proposition 1.6. Suppose X, J £ FModo(fc) and V,W £ CAGo(fc). 

(i) There is a functorial Gk-equivariant O-module isomorphism 

Homo(X, J) ®o Homfc= {V, W) ^ Homfes {I ®o V, J(»oW). 

(ii) The isomorphism of (i) restricts to an injective homomorphism 

Homc,[G,] (I, J) ®o Homfe(y, W) ^ Hom^ {I ®o V, J ®oW). 

Proof. Fix O-module isomorphisms O" ^ T and C" = J'. These isomorphisms 
induce (see Definition ll.ip isomorphisms V'^ ^ I®oV and W"^ ^ J®oW defined 
over , which induce isomorphisms 

Homo(X, J) ®o Homfee(y, W) ^ M^^^{0) ®o Homfe. {V, W) 

^ M„x„(Homfe= {V, Wj) ^ Homfe. (V", W"') ^ Homfe. {X ®o V, J^oW). 

The proof of Gfe-equivariance is similar to the proof of Gfc-equivariance in Lemma 
11.31 This proves (i), and (ii) follows since Gk acts trivially on Hom^jQ^] (X, »/) ®a 

iiomk{v,w). a 

Corollary 1.7. Suppose I,Je FModo{k) and V e CAGo{k). 

(i) The isomorphism of Proposition \1.6\f i) with W = V and the identity 
map in }lomk{V,W) gives a functorial Gk-equivariant O-module homo- 
morphism 

Homo (2:, J) — > Honifc. {I ®o V, J <»o V). 

(ii) The map of (i) restricts to a homomorphism 

Homo[G,] (X, J) Homfe(X ®o V, J ®o V). 

(iii) // the map O Endfc(V") is injective, then the maps in (i) and (ii) are 
injective. 

Proof. Assertions (i) and (ii) follow directly from Proposition II. 61 For (iii), tensor- 
ing the injection O ^ Endfc(y) with the free O-module Homo (1,^7) shows that 
Homo (X, J') ^ Homo (1,^7) ®o Endfc(F) is injective. Now (iii) follows from the 
injectivity in Proposition II. 61 □ 

If / e Homo (2^1 J) we will often write fv for the image of / under the map of 
Corollary [EHi). 

Theorem 1.8. The map {I,V) ^ I ®o V is a functor from FModo(fc) x 
CAGo(fc) to CAGo(fc). 

Proof. This follows directly from Proposition 1 1 . 6r ii) . □ 
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Corollary 1.9. Suppose I,J e FModc)(fc), V £ CAGo{k), and k C F C fc^ // 

X and J are isomorphic as 0[GF]-'modules, then the group varieties T ®o V and 
J ®o y OT^ isomorphic over F. 

Proof. If / : X — > JT^ is a Gi?-equivariant isomorphism, then the image of / under 
the functorial map of Corollary ILTf i) is an isomorphism over F from X (g)© V to 

J(g>oV. □ 

Corollary 1.10. Ifle rModz(fc), then Homfes(I(g)z Gm,G„0 = Homz(X,Z). 

Proof. Apply Proposition [rgi) with J = O = Z a.nd V = W = Gm- □ 

2. Properties of the twists I (^^o V 

For this section, fix a field k, a commutative ring O, and a commutative algebraic 
group V e C AG o{k). 

Theorem 2.1. Suppose I eFModoik). Then: 

(i) T ®o V is a commutative algebraic group of dimension rankc)(Z) dim(V"), 

(ii) I ®o y connected if and only if V is connected., 

(iii) if L is a separable extension of k and Gl acts trivially on I, then X®q V 
is isomorphic over L to ^'■anko(X)^ 

Proof. Fix a separable extension L/k such that Gl acts trivially on T. Since 
I is isomorphic as a Gi-module to 0''anko(i)^ j (g,^ y jg jgomorphic over L to 
0ranko(x) y = l/'-anko(i) CoroUary [TH giving (iii). The remaining asser- 
tions follow easily. □ 

Suppose n G Z+. If i? is an abelian group, let B[n] denote the subgroup of 
elements of order dividing n in i3. If is a commutative algebraic group over fc, 
let W[n] denote the Gfc-module W{k^)[ri\^ and if ^ is a prime let 

Ti{W) ■.= \YmW[ri 

m 

the ^-adic Tate module of W. 

Theorem 2.2. Suppose X G FModc)(/c), n G Z+, and I is prime. Then there 
are Gk-equivariant isomorphisms (with 7 G Gk acting on the right-hand sides as 
'y~^ ®^), functorial in X and V , 

(i) {X®oV){k-)'^I®o {V{k^)), 

(ii) {X®oV)[n]^X®o {V[n]), 

(iii) Ti{X®oV)^X®o{Ti{V)). 



Proof. (See Proposition 6(b) of [Mi]-) The first assertion follows from Lemma [T73l 
with A = k and L = k^. Since T is a free O-module, 

{X®o (y(fc^)))M iV[n]), 
so (ii) follows from (i), and (iii) follows by taking the inverse limit of (ii) with 
n = £". □ 

Lemma 2.3. Suppose X,J ^ FModc)(A:) with X J and J jX is free (as an 
O-module). Then the induced sequence of commutative algebraic groups over k 

— >x®oV — > j®oV — > {J IX) 0o y — > 

lis exact. 
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Proof. Since J'/X is free, there is an O-module isomorphism J X ® {J /X). It 
follows by Corollary [m that J ®o V ^ {X (^o V) ® {{J /X) ®o V) over so the 
sequence of the lemma is a (split) exact sequence over . But then the sequence 
is exact over k. □ 

Define a k-isogeny in CAGo{k) or in FModc)(fc) to be a fc-morphism whose 
kernel and cokernel are annihilated by some positive integer. 

Lemma 2.4. IfX, J G FModc)(fc) and s :X ^ J is a k-isogeny, then the induced 
map sv ■ X iE)o V ^ J ®o V is a k-isogeny. 

Proof. Suppose n G Z+ is such that n ■ ker(s) = and n ■ coker(s) = 0. Then there 
is a fc-isogeny t : J X such that t o s and sot are both multiplication by n^, so 
Sv otv ^ Endfc( J' ®o V) and o sy g Endfe(I ®o are both multiplication by 
. Therefore sy is a fc-isogeny. □ 

Corollary 2.5. Suppose X, Ji, Jt eYMoAoik) , and X (gi^Q ^ ®UiiJ,(S>zQ) 
as 0[Gk]-niodules. Then X®o V is k-isogenous to ®\^i{J^i ®o V)- 

Proof. In this case X is fc-isogenous to ®iJi, so by Lemma [2^ X®o V is fc-isogenous 

Proposition 2.6. Suppose I, J7 G FModc)(fc). Then there is a natural isomor- 
phism iX ®o J) ®0 V = X (g)© {J ®o y) over k. 

Proof. Suppose A is a commutative fc-algebra. Then applying Theorem 11.41 and 
Lemma 11.31 with L — k^ (suppressing the subscripts O and k from the tensor 
products) 

{X(S,{J (g)V)){A) = {X(g){{J (g)V){A(S,k''))f'' 
'^ {X(E){ J (g){V{A(g)k''))f>' 
= {{X(g)J)(g>{V{A(E)k''))f>' 
= {{X(g)J)(g)V){A). 

These isomorphisms are functorial in A, so the proposition follows from a variant 
of the Yoneda Lemma (see for example Proposition VI-2 of [EHj ) . □ 



3. Annihilator modules 
The results of this section will be used in i]4] and ijTl 

Fix a finite Galois extension L/k, a commutative ring O, and a commutative 
algebraic group V G CAGci(fc), and let G := Gal(L/fc). Let FModci(L/fc) de- 
note the full subcategory of FModc)(fc) whose objects are the ^^[Ga;] -modules in 
FModc)(fc) on which Gl acts trivially. 

Definition 3.1. For X G FModo{L/k), define a left 0[G]-module 

J:-Homo[G](I,0[G]) 

with 0[G] acting by {a ■ f ){x) — a ■ f{x) for every a G ^^[G], f E X, and x G X. 
Also define an O-module homomorphism vr : 0[G] O by 7r(^ggQ o,g9) — o-i- 

Part (i) of the following lemma shows that X is independent of the choice of L. 
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Lemma 3.2. (i) For each JC G FModci(L/A;), the map / i-^ tt o / defines an 

isomorphism of left Gk -modules 

/C^Homo(/C,0). 

(ii) IfX^J € FModc)(i/A;), T J ^ and J /I is a projective O-module, then 
the canonical sequence Q^J/I^J^I^Q is exact. 

Proof. For (i), see for example Propositfon VI. 3. 4 of [Bj. Assertion (ii) foUows from 
(i), since the exact sequence of C-modules ^ 2" ^ J" — > J /I — > splits if J /I 
is projective. □ 

Lemma 3.3. Suppose 2, J' E FlsAoda{L/k), T Q J, and J /I is a free O-module. 
Then 

X®oV^ Pi ]^GY{fv : J ®oV ^0[G]®oV), 

where fv is the image of f under the map 

Homo[G](^/X,0[G]) ^ Homo[G](J,0[G]) VLouik{J ®o V,0[G] ®o V) 
coming from Corollary \1. T^ ii ) . 

Proof. Choose an O-basis {/i, . . . , fd} of Homo(J'/T, O). For every i let 0^ € J/l 
be the inverse image of /; under the isomorphism of Lemma l3.2f i) (with JC — J l'X\ 
so TTo^j = with TT defined in Definition l3.ll Then there is a commutative diagram 
of O-modules, with the top line an exact sequence of ©[GJ-modules 

^Jjl^^OiGY -C -0. 

(3.1) 

Qd 

Then (©/i)~^ o tt'' gives a splitting of the top exact sequence, so C is isomorphic as 
an O-module to the kernel of tt'', which is free. Therefore we can apply Lemma [^751 
both to the top line of p.ip and to the exact sequence O^X^i/^J^/X^Oto 
obtain an exact sequence 

^^x®oy ^ J ®oy {o\G\®oyf -*c®oV 

By Lemma [3^ 1). (f>i, . . . ,(j>d generate J/2, so 

I^oV = ker(®(0,)y) = n^gjy5.ker(/y). 

□ 

Definition 3.4. If X is a right ideal of ©[G], let denote the left annihilator of 
I, i.e., is the left ideal of 0[G] defined by 

:= {a e 0[G] : al=0}. 

A (right or left) ideal X of 0[G] is saturated if 0[G]/X is a projective O-module. 

A finitely generated Z-niodule is projective (or equivalently, free) if and only if it 
is torsion-free. Thus when O = Z, intersecting with Z[G] (inversely, tensoring with 
Q) gives a one-to-one correspondence between the ideals of Q[G] and the saturated 
ideals of Z[G]. 
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Lemma 3.5. Let A : 0[G] —^ 0[G] be the ring isomorphism that sends a e 0[G] 
to left multiplication by a. Then: 

(i) If X is a right ideal of 0[G] then the restriction of X induces an isomor- 
phism 

^ 6\G]Jl. 

(ii) IfX is a saturated right ideal of 0[G], then T — {a E 0[G] : • a ~ 0}. 

(iii) If 2 is a saturated two-sided ideal ofO[G], then A induces an isomorphism 
0[G]/I^ ^ Endo[G](I) (and Endo[G](I) = 1). 

Proof Suppose I is a right ideal of 0[G]. The map 0[G] ^ 0[G] defined by 
/ /(I) is a right and left inverse of A. Thus A is an isomorphism and there is a 
commutative diagram with exact rows 



^ ^ 0[G] ^ 0[G 

X AS 

— ^ oidyi — ^ o\G] ' 



/I^ -0 

(3.2) 



where the right-hand vertical map is injective by definition of X . The snake lemma 
shows that the left-hand vertical map is an isomorphism, which proves (i). 

Now suppose T is saturated. If /3 £ 0[G] — T, then there is an O-module 
honiomorphism from 0[G]/T to O that is nonzero on (3. Now (ii) follows from (i), 
along with Lemma [3.2( 1) with K. — 0[G]/I. 

Since I is saturated, by Lemma [3.2r ii) the bottom right-hand map of (|3.2p is 
surjective, and hence the right-hand vertical map is an isomorphism. If Z is a two- 
sided ideal, then \{0[G\/I^) C Endo[G](X) C I, so equahty must hold and the 
proof of (iii) is complete. □ 

4. Decomposing the restriction of scalars 

In this section we decompose the restriction of scalars of a commutative algebraic 
group. Theorems 14. 5i [5T2l and 15.51 were proved by Diem and Naumann in §3.4 and 
§3.5 of |DNj in the case of abelian varieties. 

Fix a finite Galois extension L/k, a commutative ring O, and a commutative 
algebraic group V G CAGc)(fc), and let G :— G&\{L/k). Let Yles^V denote the 
Weil restriction of scalars of V from L to k (see for example §1.3 of |Wj or §3.12 of 
[V]). Then for every commutative fc-algebra A there is an isomorphism, functorial 
in A, 

{Kcs]^V){A)'^V{A®kL). (4.1) 
Proposition 4.1. 0[G] ^qV = Res^ F over k. 

Proof Let := QgecO, := (SgecV, and for 5 G G let pg : ^ V he the 
projection onto the g component. Using the O-module isomorphism j : O'-^ — > 0[G] 
defined by j{{xg)) = ^gXg9~^: Definition 11.11 gives a pair {0[G] (80 V,(f)) where 
(j> : ^ 0[G](g)oV is an isomorphism over L. Let rj := pio(j)-^ : 0[G] (g)oV ^V. 
The cocycle co[g] S H^{k,Autk>'{V'~^)) of Definition 11.11 satisfies ph o co[g]{9) = 
Pg~ih for every g,h e G, so (using ()l.ip ). 

T]^ ^PlO = Pl o Co[G]{gy^ ° ^Pg° <P^^- 
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Therefore (Br]^ : 0[G] ®o V — > V'^ is an isomorphism (it's equal to </> so by the 
definition of Res^ F in §1.3 of [W], 0[G] (S)oV^ Resj^V over k. □ 

For the rest of this section we will take O — Z and write simply "®" in place of 
"(8>z"- The functorial map of CoroUarv Il . 7f ii) (withX = J = Z[G]) and Proposition 
14.11 give natural ring homomorphisms 

Z[G] ^ Endz[G](Z[G]) ^ Endfe(Z[G] ® ^ Endfc(Res^F). (4.2) 

If Of £ Z[G], then we denote its image under (|4.2p by ay G Endfc(Res^y). 

Proposition 4.2. If 2 is a saturated right ideal ofZ[G], then: 

(i) I^V ^ Haei^ keiiav : Resj^V Res^ F). 

(ii) For every commutative k-algehra A there is a functorial isomorphism 

{I(g>V){A) ^{veV{A(E)k L) -.1^ -v^O}. 

(iii) // further X is a two-sided ideal, then there is a natural infective ring 
homomorphism 

(Z[G]/Z-L) ® Endfe(y) Endfc(X(» y). 

Proof. By Lemma [33i;i) , Zfcj/X = . By Lemma [33] (with J = Z[G]) and 
Proposition [41] we have (i). Assertion (ii) follows from (i) and (|4.ip . 

If I is a two-sided ideal, then Z[G]/Z^ ^ Endz[(3](X) by Lemma [321 iii) • Now 
(iii) follows from Proposition 1 1 . Gf ii) (with J — I and W — V). □ 

The group ring Q[G] is semisimple, and decomposes into a direct sum of minimal 
two-sided ideals 

= eQ[G]p (4.3) 
p 

indexed by the irreducible rational representations p of G. Here Q[G]p is the p- 
isotypic component of (Q[G], i.e., the sum of all left ideals of Q[G] isomorphic to 

P- 

Definition 4.3. If p is an irreducible finite-dimensional rational representation of 
Gfc, choose a finite Galois extension L/fc such that p factors through G := Gdl{L/k), 
define 

Ip ■= Q[G]p n Z[G] e FModo(A:), 
and define the p-twist of V by 

Vp Jp ® V. 

Remark 4.4. Note that Tp is well-defined up to Z[Gfe]-isomorphism, independent 
of the choice of L, and therefore Vp is well-defined up to isomorphism over k. Since 
Q[G]p is a Q- vector space, 2p is a saturated ideal of Z[G]. 

Theorem 4.5. Suppose L/k is a finite Galois extension, V is a commutative alge- 
braic group over k, and G :— Gal[L/k). Then Resj.^ is isogenous over k to ®pVp, 
direct sum over all irreducible rational representations of G. 

Proof. This follows from Proposition [iH gS]), and Corollary [2H with I ^ Z[G] 
and with {J7i, . . . , Jt] — {Ip ■ p an irreducible rational representation of G}. □ 
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5. Abelian twists 

Fix a finite abelian extension L/k and a commutative algebraic group V over fc, 
and let G = G&\{L/k) and = 1.. 

The irreducible rational representations of G are in one-to-one correspondence 
with the cyclic extensions of k in L. (See for example exercise 13.1 of LSe2 .) Namely, 
if p is an irreducible rational representation let Fp be the fixed field of the kernel 
of p, and if is a cyclic extension of /c in L let pp (or pp/ki if we need to specify 
the field k) denote the unique irreducible rational representation of G with kernel 
Gal(_L/F). If [F : fc] = c? then dimpi? = <p(rf), where ip is the Euler (p-function. 

Definition 5.1. Suppose F is a cyclic extension of k in L, and pp is the corre- 
sponding irreducible rational representation of G. Let Q[G']i? denote the pf-isotypic 
component of Q[G], and let 

Zf := Q[G]j=^ nZ[G], Vf:=Tf®V 

(these were denoted Q[G]pj^, Ipp, and Vpp in (|4.3p and Definition 14. 3p . When 
necessary to specify the ground field fc, we will write Tp/^. and Vp/j.. Let Rp 
denote the maximal order of the field Q[G]f. 

By Remark I4.4[ Ip and Vp are well-defined up to isomorphism, independent of 
the choice of field L containing F, and Ip is saturated in Z[G]. 
The following result is a special case of Theorem 14.51 

Theorem 5.2. If L/k is a finite abelian extension and V is a commutative algebraic 
group over k, then Res^y is isogenous over k to dBpVp, direct sum over all cyclic 
extensions F of k in L. 

UkCFCL, let 

Nl/f-= E 5eZ[G]. 

geGa.\{L/F) 

Define 

Ql ■■= {fields F -.kCF CL} D n'^ := {F : k 'Z F C L, [L : F] prime}. 
Then every element of fl^ is a subfield of some element of 51^, and we define 
Wl:= fl kev{NL/Fy)^ f] M^^L/f.y) ^ Res^F, 

where Ni^/py £ Endi:(Res^y) is the image of Ni^/p under (|4.2p . We will see in 
Theorem 15. 8f i) below that if L/k is cyclic, then Wl = Vl- In the non-cyclic case 
we have the following. 

Proposition 5.3. If L/k is abelian but not cyclic, then dim(WL) = 0. 

Proof. Since L/k is not cyclic, there are a prime p and a field M such that k C 
M C L and Gal(L/M) = (Z/pZ)^. Since there are exactly 1 degree p extensions 
of M in L, in Z[G] we have the identity 

J2 Nl/f =P + Nl/m- 

MCPCL 

Since Wl is in the kernel of all the norm maps in this identity, it follows that Wl 
is contained in the kernel of multiplication by p, so dim(WL) =0. □ 
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Suppose for the rest of this section that L/k is cychc. Theorems 15.51 15.81 ^nd 
15.91 below are our main results about Vl in the cyclic case. Let r := \G\ ~ [L : k], 
and fix a generator r of G. For d e Z+ let $d G Z[x] denote the d-th cyclotomic 
polynomial, and let "^dix) := {x'^ - l)/^dix) S Z[x]. 

Lemma 5.4. (i) II = «'r(r)Z[G] andlj; = $r(T)Z[G]. 

(ii) Every isomorphism x ■ G ^ fi^ induces a ring isomorphism Rl ^ Z[/i,,^]. 
This ring isomorphism is G-equivariant, with g E G acting on Z[fij,] as 
multiplication by x{g)- 

(iii) The projection Q[G] -» Q[G]l given by (|4.3p induces a G-module isomor- 
phism Z[G]/2:f ^ Rl- 

(iv) II = Ylprtmes £ | riCi - ^)Rl, wkcrc for cach prime i dividing r, Q is a 
primitive £-th root of unity in R^. 

Proof. Let S = Q[x]/{x^ — l)Q[x]. Since G is cyclic of order r, the homomorphism 
77 : Q[G] S that takes r to a; is a Q[G] -module isomorphism, where r acts 
on 5* as muhiplication by x. Since Q[G]l = Q[a;]/$r(a;)QN = '^rix)S C S* as 
Q[G]-modules, and Q[G] (and hence 5") has a unique Q[G]-submodule isomorphic 
to Q[G]l, we have 77(Q[G]i) = 'i'r{x)S. It follows that the isomorphism 77 : Z[G] = 
Z[a;]/(a;'' — l)Z[x] maps 1l (resp., isomorphically onto the ideal generated by 
^r{x) (resp., by ^r{x))- Both assertions of (i) now follow. 

If X : G /x^ is an isomorphism, then t ^ x ^ xi^) induces isomorphisms 
Q[G]l ^ Q[a;]/$r(a;)Q[a:] ^ Q(/i.^). The composition maps the maximal order Rl 
isomorphically to the maximal order Z[/.i^], giving (ii). 

Using (i) and (ii), there is a commutative diagram 

^ ^rix)Z[x]/{x'' - l)Z[a;] ^ Z[x]/{x'' - l)Z[x] Z[x]/^rix)Z[x] 

^Jt ^ ^[G] ^ Rl ^ 

with vertical isomorphisms, where the map A is induced by Q[G] -» Q[G]l. Since 
the top row is exact, so is the bottom row, giving (iii). 
Let fj, denote the Mobius function. Then 

^^J,{x) = {x'^ ^l)/^rix)^ ]J (a;'^/'^-l)-'^('^). (5.1) 

d\7\d=il 

In Z[a;]/$r (a;)Z[a;] , x is a primitive r-th root of unity, so x'^^'^ has order d, so x' ^'^ — 1 
is a unit in 'Z[x]/^rix)'Z[x] unless d is a prime power. When d ^ 1 is a prime power, 
fj,{d) = — 1 if d is prime, and fj,{d) — otherwise. By (i), rj{TL) is generated by 
^'r(a;), so by (|5.ip . the ideal X{Il) of Rl is generated by H^irCCf ~ Since 
C (!2[G]l, A is the identity map on Tl- This proves (iv). □ 

Theorem 5.5. Suppose L/k is a cyclic extension of degree r, and V is a commu- 
tative algebraic group over k. Then: 

(i) Vl is a commutative algebraic group of dimension Lp{r)diu\{V). 

(ii) // V is connected then Vl is connected. 

(iii) Vl is isomorphic over L to F'^M. 

(iv) There is an infective ring homomorphism Rl (K)Endfc(T^) ^ Endfc(y£,). 
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Proof. Parts (i), (ii), and (iii) follow from Theorem 12.11 since rankz^L = dimpi = 
(p{r). Part (iv) follows from Proposition [42^111) and Lemma iii) . □ 

Lemma 5.6. The ideal of'Z[x]/{x^ — l)Z[x] generated by ^rix) is also generated 
by each of the following sets 

(i) {{x^ -l)/{x''-l):d\r,d^r}, 

(ii) {{x"^ - l)/(x'~/^ -1) -.tlr, £ prime}. 

Proof. The identity x^ ~1 — JJ^^^ ^dix) shows that ^rix) divides (a;'' — l)/(a;'' - 1) 
for every divisor d < r of r. On the other hand, Theorem 1 of [dB| or |Re| shows 
that ^r{x) is a Z[a;]-linear combination of {{x^ — l)/{x'^ — 1) : d \ r,d ^ r}. This 
proves (i). Every element in the set (i) is divisible by one of the elements in its 
subset (ii), so this completes the proof. □ 

Lemma 5.7. Each of the sets {^rir)}, {Nl/f ■ F e Ql}, {Nl/f ■ F e Q'^} 
generates the ideal ij^ C Z[G]. 

Proof. If A: C C L and [F : fc] = d, then N^/f goes to (a;'" - l)/{x'^ - 1) under 
the isomorphism 1\G] ^ Z[x]/{x'^ — l)Z[a;]. Thus by Lemma [STBl the three sets of 
this lemma generate the same ideal of Z[G]. By Lemma IS^ i). this ideal is T^. □ 

Recall that if a G Z[G], then ay G Endfe(Res^y) denotes its image under (|4.2p . 

Theorem 5.8. Suppose L/k is a cyclic extension of degree r, and V is a commu- 
tative algebraic group over k. Then: 

(i) Vl = HFGn^ kei{NL/Fy) = ^Few^ keT{NL/Fy) = ker($,(T)y) C Res^V , 
where t is any generator ofGal{L/k). 

(ii) If A is a commutative k-algebra, then 

Vl{A) {a e V{A 0fc L) : NL/F{a) = for every F e ^l}. 
In particular, 

VL{k) ^{aG V{L) : Nl/f {a) = for every FeflL}. 
Both assertions also hold with £7^ replaced by . 

Proof. Assertion (i) (resp., (ii)) follows from Lemma 15.71 and Proposition I4.2r i) 
(resp., (ii)). □ 

Theorem 5.9. Suppose L/k is a cyclic extension of degree r, and V is a commu- 
tative algebraic group over k. Suppose that £ is prime and g G Gfc. Let d he the 
order of the restriction of g to G :~ Gal{L/k). If the characteristic polynomial of 
g acting on T£{V) is Yiii-^ ~ '^i) "with a,; G Q^, then the characteristic polynomial 
of g acting on Ti(Vl) is 

YliX - a.O'^W/'/'W 
where C runs through all primitive d-th roots of unity. 

Proof. By Lemma lS^ ii) , the eigenvalues of the generator t G G acting on (g)Q = 
Rl'^Q are exactly the primitive r-th roots of unity in Q, each with multiplicity one. 
It follows that the eigenvalues of g acting on are the primitive d-th roots of unity, 
each with multiplicity Lp{r) / ip{d). The result now follows from the isomorphism 
Ti{Vl) ^II® TeiV) of Theorem [2Ji;iii). □ 
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Proposition 5.10. Suppose L/k is cyclic, F and M are extensions of k in L, 
F n M = k. and L = FM . If V is a commutative algebraic group over k, then 
{Vf)m = Vl over k. 

Proof. Let d = [F : k] and e = [M : k]. Then de = r. Since L/k is cyclic, d 
and e are relatively prime. By Lemma 15. 4( 11. iv). there are isomorphisms of Z[G]- 
modules Xp = Im — ^[Meli ^^'^ — ^[Mrli where the chosen generator r 

of G acts on the right-hand sides as multiplication by (^d, Ce^ and Cr, respectively, 
and where the roots of unity are chosen so that (^^Ce — Cr- Then the natural map 
'^z^ifJ-el ^ ^[/^r] is an isomorphism of Z[G]-modules. Hence Xl = Xm (X'z^'f, 
and the proposition follows from Proposition 12.61 □ 

Remark 5.11. Suppose k C F C L. Let Ni^/p : Z[G] — > Z[G] denote multiplica- 
tion by EheGai(L/F) Then N^/f factors as 

Nl/f ■■ Z[G] Z[Gal(F/fc)] ^ '^^^ > Z[G] 

where Rl/f is the natural projection map. Since ker(i?i/^) and coker(ti/^) are 
torsion-free. Lemma 12.31 shows that the induced maps Rl/f.v a-i^d ^'L/f.v ij^ the 
composition 

Nl/f,v ■■ Res^y ^^/^-v^^^ Re4v ' '^'^'"^ ^ Res^V (5.2) 

are surjective and injective, respectively. In |RS1[ lRS2l IRS3| . the primitive sub- 
group of Res^y corresponding to L was defined to be Tl := ClkCFCL ^gt{Rl/f,v)- 
By ([521), keiiRL/F,v) = ^eiiNL/F,v)- So when L/k is cyclic, Tl ^ Vl = Wl (the 
last equality by Theorem l5.8f i)). 

6. Semidirect products 

Suppose for this section that L/k is a finite Galois extension, and G Gal(i/fc) 
is a semidirect product F x 77 of a normal cyclic subgroup F — Ga,l{L/K) of order 
r by a subgroup H — Ga\{L/M). There is a diagram 

L 



K 

k 

and we view Z[F] and Z[i7] as subrings of Z[G], so Z[G] = Z[F]Z[i7] = Z[i7]Z[F]. 
Let Pl/k be the (unique) irreducible faithful rational representation of F, and 
Q[r]L/A' the p^/x-isotypic component of Q[F]. Let Xl —Xl/k ^ ^P] be the ideal 
Q[r]L/K n Z[F] of Definition O so Xl G ¥M.odz{K). 

In this section we will show (Theorem l6.3l below) that the commutative algebraic 
group Vl/k ^ Xl <E) V € CAGz{K) of Definition 15.11 has a model over k of the 
form Jl (^V £ CAGz(fc) for a suitable right ideal Jl of Z[G]. This is needed for 
the applications in |MR| . in the case where G is a dihedral group of order 2r. 
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Define 

Nh ^ /i e Z[i/] C Z[G]. 

heH 

Lemma 6.1. The ahelian group J7l '■= N^Il is a saturated right ideal ofX^G]. 

Proof. For h £ H, the representation p^^^ of F defined by p'l/^i'y) — PL/K{h'yh~^) 
is an irreducible faithful rational representation of F, so p^^^ — Pl/k- Hence 
hlLh^^ — II in Q[G], so ioi h £ H and 7 G F we have 

NnlLh - NnhlL - NhIl, NhIlI - NhIl, 
so Nh'Il'^[G\ = NhIl- Since II C Z[F] is saturated, Jl C Z[G'] is saturated. □ 

Definition 6.2. Define V^/k ■= J^l^V where J'l NrIl as in Lemma l6m This 
definition depends on the subgroup H of G; if necessary we will denote Vl/Zc by 
yL/k,H- Theorem 16 . 31 below shows that if H' is another subgroup with G = F xi i?', 
then Vi^/k u' is isomorphic to V^/fe,// over K. 

Tiieorem 6.3. Over K there is an isomorphism Vt/fe — ^l/K; where Vl/k (resp., 
^L/k) is given by Definition \5.1\ (resp., Definition \6.S\) . 

Proof. Left multiplication by Nh is an isomorphism Xl Jl of right Gi<--modules. 
By CoroUarv Il . 91 with F = K,Vl/k — Vx^ is isomorphic over K to Vl/*: = Vjl ■ ^ 

7. Finite group actions on I (^V 

In this section we study the action of symmetric groups on the group varieties 
T(S)V. When V is an algebraic torus, these results provide insights into some known 
cryptosystems (see |RS21 IRSS] ). 

Fix a finite Galois extension L/k and let G :— Ga\{L/k) (and O = Z). Fix 
also a commutative algebraic group V over k that is not isogenous to the trivial 
group, i.e., so that the natural map Z Endk{V) is injective. If cr G Endz(Z[G]), 
let (TV G Endi(Res^y) denote the endomorphism given by the functorial map of 
CoroUarv ll.yr i) (with T = J — Z[G]). If X is a saturated right ideal of Z[G], view 
J (gi 1/ C Res^V via Lemma [Ol (with J = Z[G]) and Proposition O 

Lemma 7.1. Suppose thatX is a saturated right ideal ofJ^G], anda G Endz(Z[G]). 
Then the following are equivalent: 

(i) C I. 

(ii) av{I(E)V) CI(g)V. 

Proof. If cr{T) C T then (j\x G Endz(I). By the functoriality of I i— > 1/, we 
have (Jvlx^v G EndL{I fE) V). Thus (i) =^ (u). 

Conversely, suppose av{T (^V) C 1(g) 1/ and let A : Z[G] Endz(Z[G]) denote 
the map that sends a G Z[G] to left multiplication by a. Suppose a G I and 
(3 G I^. Then aZ[G] C Z, so ay G Endfc(ReSfcI/) factors through I(g)V, i.e., 
av{ReSkV) <ZX®V. Therefore 

(A(/3) o a o A(a))y(Res^I/) = /3v(CTv(av(Res^V))) C (3v{T®V) = 

by PropositionHSIi). By Corollary [LTlui), the map Endz(Z[G]) Endfe=(Res^y) 
is injective, so A(/3) o a o X{a.) = 0, and thus /9 • a{a) = (A(/3) o a o A(q;))(1) = 0. 
Therefore X^cr(Z) = 0, so f7(X) C I by Proposition [HSJu). Thus (ii) ^ (i). □ 
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Let 'Sh denote the group of permutations of a set H. If G Eg, let a S 
Autz(Z[G]) denote the automorphism induced by a, and let ay G AutL(Res^y) 
denote the corresponding automorphism of Hcsj^V . 

Lemma 7.2. Suppose that L/k is cyclic and a G Sg. Then the restriction of ay 
to Vl is an automorphism of Vl if and only if 

{*) for every g d G and subgroup H of prime order, a{gH) = a{g)H. 

Proof. Since a has finite order, the restriction of ay to is an automorphism if 
and only if (jvi^L) Q Vl, which by Lemma 1 7 . II happens if and only if o'(Il) ^ ^l- 
Write G = Gi X ■ ■ ■ X Gt where each Gi is of prime power order, \Gi\ = pW ordered 
so that pi < . . . < pt- For 1 < i < t, let Hi be the subgroup of Gi of order pi, and 
let Nh, = J2heH, h £ AG]- By Lemma [53 

t 

=^Z[G]iV^.. (7.1) 

i=i 

If (7 satisfies (*) then a{NHia) — ■ <5'(ck) for every a G Z[G] and every i, so 
li ■ cj{Il) = nG]NH^ ■ = Z[G] • a{NH^ ■ II) - 0, 

i i 

since -II — ^ for all i. By Proposition IS.Sf ii) we conclude that (j{Tl) C I^, 
so by Lemma mi (Tv\vl G Aut(VL)- 

Conversely, suppose (*) fails to hold for some H. Take j minimal so that there 
is a 7 G G with a{jHj) ^ (T{'^)Hj. Replacing a by r^i^^-^-i o a o r-y (where Tg G Sg 
is left multiplication by 5 G G) we may assume without loss of generality that 
cr(l) = 1, (j{Hj) ^ Hj, and a{gHi) = a{g)Hi for all g G G and i < j. It follows 
that a^^{gHi) — a^^{g)Hi for all g G G and i < j, so 

^-'(^n^') =^"'(-9)11^' for every 5 gG. (7.2) 

Let TTi : G ^ Gi be the projection map. For 1 < i < t, fix 1 Si E Hi such that 

(Ma~^iHj)) if*>j, 
S,^la-\H,) ifz-j, 

[M<j-\H,)ns,ii^<,H.O if l<z<j. 

The first is possible since pi > pj if i > j; the second since <j{H.j) ^ Hj] and the 
third because it follows from (|7.2p that the elements of a^^{Hj) lie in distinct cosets 
of Y[i<j Hi, and \Hi\ ^ pi >3 ii i > 1. 

If 5 C {1, • • • , t}, let ds = Uies Note that (5s = 1 if and only if 5 = 0. We 
claim that if a{Ss) G Hj, then either S — ^, or else S ~ {1, j} and j ^ 1 (in which 
case ds = Sidj). To prove the claim, suppose 7^ (so (5s ^ 1) and a{Ss) G Hj. 
Then Tri{ds) S TTi{a~^{Hj)). Note that TTi{6s) is Si ii i E S and is 1 otherwise. 
By our constraints on the Si, if i > j then i ^ S. If j ^ S, then applying (|7.2p 
with 5 = 1 gives cr(5s) & {Yli<j Hi) n -ffj = {1}, contradicting that cr(l) — 1 and 
(5s 7^ 1. Thus i G S*, and again by our constraints, if 1 < z < j then i ^ S. Since 
(j{6j) ^ i/j, we cannot have S — {j}. We have thus proved the claim. 

Let a := 11^=1(1 ~ ^i) = Ss(~-'^)''^''^-S ^ ^[G], with S" running over subsets 
of {1, • ■ • ,t}. By the claim above, a{a) = '^gi—^y^^criSs) = 1 + ^g^Hj ^gd '^'^ 
1 + aiSiSj) + X^g^ff ^§9 with G Z. It follows that Nh^ ■ (7(a) ^ 0, since the 
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coefRcient of the identity element is either 1 or 2, so (T{a) ^ 2l by Lemma lSTTl Since 
5i € Hi, we have TV/f. {1 — Si) ~ for aU i. Thus by ()7.1|) . T^a = 0, so by Proposition 
ICT ii). a e II- Therefore (7(Xl) 2 ^l, so by LemmaO (Ty(VL) 2 ^l- □ 

If \G\ is squarefree, and H is a subgroup of G, then there is a unique subgroup 
J C G such that G — H x J, and this decomposition induces an inclusion Y,h C Eq. 

Theorem 7.3. Suppose L/k is cyclic of squarefree degree, \G\ = Pi---pt with 
distinct primes pi, Hi is the subgroup of G of order pi, and a G Eq. Then ctvWl ^ 
Aut(Vi) if and only if a ^ 11^=1 ^g)- 

Proof. Suppose cr G J^^ ^ffi- It is easy to see that for every g G G and every i, 
a{gHi) = a{g)Hi. By LemmaO av\vL S Aut(VL)- 

Conversely, suppose avlvL ^ Aut(yL)- By Lemma [7^ a{gHi) = a{g)Hi for all 
g & G and all z. Let iTi : G ^ Hi denote the projection, and let ai = a\H. : Hi ^ G. 
Let Ti = TTi o ai G ^Hi- It follows easily that a = 0'=i Ti o ivi G a G Yii '^Hi- O 

Appendix. More general construction 

Although in the above discussion we restrict to the case of free O-modules 2, the 
tensor product construction (Z, V) t-^ X®ciV in the appropriate category of sheaves 
for the etale topology (as alluded to in the introduction) is quite general. Moreover, 
this more general construction can also be formulated in fairly concrete terms. For 
example, suppose that O is a commutative noetherian ring, V G CAGc)(/c), and X 
is a finitely generated O-module with a continuous right action of Gk, but do not 
assume that Z is a free O-modulc. Let i be a finite Galois extension of k such that 
Gl acts trivially on Z, and let G := G&\{L/k). Since O is noetherian, there is an 
C'[G'] -presentation of X, i.e., an exact sequence 

OIGY" 0[G]'' —>I—>0 

of right ©[GJ-modules. By basic properties of the functor V t-^ Res^V^ (or for 
example, by CoroUarv II. 7( 111 and Proposition 14. 1 p . induces a fc-homomorphism 

: {Resj^Vr ^ (Res^F)^ 

and we can define 

I(S)oV -.^ coker(V'u) G CAGo(fc). 
One can show that this definition is independent of the choice of L and of the 
presentation of X, and it agrees with Definition II. II if X is a free O-module. Further, 
without the assumption that the O-modules are free. Theorem 11.81 Corollaries 
11.91 11.101 and 12.51 and Lemma 12.41 all remain true verbatim, Proposition 11.61 and 
CoroUarv 1 1 . 71 hold if X and J' are projective O-modules, Theorem 12.21 holds if X is 
a projective O-module, and Lemma [2731 holds if X/J' is a projective O-module. 

This definition of X ®o V is essentially the same as Conrad's definition of his 
1®0[G] R-es^y in Theorem 7.2 of C , using the action of 0[G] on Res^F given by 
(1421) above. 
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